diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 000000000..28aaa4f93
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,138 @@
+name: Docker
+
+on:
+  push:
+    branches: [main, release/**]
+  pull_request:
+  release:
+    types: [published]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  REGISTRY_IMAGE: stellar/stellar-cli
+
+jobs:
+
+  complete:
+    if: always()
+    needs: [build, merge]
+    runs-on: ubuntu-latest
+    steps:
+    - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+      run: exit 1
+
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - runs-on: ubuntu-latest-16-cores
+          platform: linux/amd64
+        - runs-on: ubuntu-jammy-16-cores-arm64
+          platform: linux/arm64
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+    - name: Prepare
+      run: |
+        platform=${{ matrix.platform }}
+        echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY_IMAGE }}
+        tags: |
+          type=sha
+          type=raw,value={{tag}}
+
+    # QEMU is needed if building arm64 on amd64, but it is commented because the
+    # build is currently configured to build each natively.
+    # - name: Set up QEMU
+    #   uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build
+      uses: docker/build-push-action@v6
+      with:
+        platforms: ${{ matrix.platform }}
+        labels: ${{ steps.meta.outputs.labels }}
+        outputs: type=docker,dest=/tmp/myimage.tar
+
+    - name: Login to Docker Hub
+      if: github.event_name == 'release' && github.event.action == 'published'
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Push by digest
+      if: github.event_name == 'release' && github.event.action == 'published'
+      id: push
+      uses: docker/build-push-action@v6
+      with:
+        platforms: ${{ matrix.platform }}
+        labels: ${{ steps.meta.outputs.labels }}
+        outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+
+    - name: Export digest
+      if: github.event_name == 'release' && github.event.action == 'published'
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.push.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest
+      if: github.event_name == 'release' && github.event.action == 'published'
+      uses: actions/upload-artifact@v4
+      with:
+        name: digests-${{ env.PLATFORM_PAIR }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+  merge:
+    if: github.event_name == 'release' && github.event.action == 'published'
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Download digests
+      uses: actions/download-artifact@v4
+      with:
+        path: /tmp/digests
+        pattern: digests-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY_IMAGE }}
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Create manifest list and push
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+    - name: Inspect image
+      run: |
+        docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 000000000..9055936b1
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,8 @@
+FROM rust:bookworm AS builder
+WORKDIR /wd
+COPY . .
+RUN cargo install --locked --path cmd/stellar-cli --bin stellar --features opt
+
+FROM gcr.io/distroless/cc-debian12:latest
+COPY --from=builder /usr/local/cargo/bin/stellar /usr/local/bin/stellar
+ENTRYPOINT ["stellar"]
diff --git a/Makefile b/Makefile
index 7e307b16c..4a6ac7d9a 100644
--- a/Makefile
+++ b/Makefile
@@ -78,6 +78,8 @@ typescript-bindings-fixtures: build-test-wasms
 					--output-dir ./cmd/crates/soroban-spec-typescript/fixtures/test_custom_types \
 					--overwrite
 
+docker:
+	docker build -t stellar/stellar-cli:dev .
 
 # PHONY lists all the targets that aren't file names, so that make would skip the timestamp based check.
-.PHONY: publish clean fmt watch check e2e-test test build-test-wasms install build build-snapshot typescript-bindings-fixtures
+.PHONY: publish clean fmt watch check e2e-test test build-test-wasms install build build-snapshot typescript-bindings-fixtures docker